BACK TO IT ACT
IT Act 2000AMENDED 2008
Section 21
Licence to Issue Electronic Signature Certificates
THE STATUTE
Original Text
(1) Subject to the provisions of sub-section (2), any person may make an application, to the Controller, for a licence to issue Electronic Signature Certificates. (2) No licence shall be granted under this section unless the applicant fulfils such requirements with respect to qualification, expertise, manpower, financial resources and other infrastructure facilities, which are necessary to issue Electronic Signature Certificates as may be prescribed by the Central Government. (3) A licence granted under this section shall — (a) be valid for such period as may be prescribed by the Central Government; (b) not be transferable or heritable; (c) be subject to such terms and conditions as may be specified by the regulations.
Simplified
Section 21 is the licensing gateway for India's Certifying Authority regime. Only entities that obtain a licence from the CCA under this section may legally issue Electronic Signature Certificates in India. The licensing criteria — prescribed through the IT (Certifying Authority) Regulations — are stringent: financial stability, technical infrastructure meeting PKI security standards, audited key management procedures including Hardware Security Modules (HSMs), disaster recovery systems, and appropriate professional indemnity insurance. The non-transferability requirement in Section 21(3)(b) is important: a CA licence cannot be sold, assigned, or inherited — if a licensed CA is acquired, the acquirer must obtain its own licence. This prevents the trust built around a CA's reputation from being transferred to a new entity that has not met the licensing criteria. Currently, six entities hold active CCA licences in India: eMudhra, Sify Technologies, NSDL e-Governance Infrastructure, (n)Code Solutions (GNFC), CDAC, and IDRBT. Operating as a CA without a valid licence is penalised under Section 42 of the IT Act.
Legal Evolution
The licensing framework was designed to ensure only technically and financially sound entities could issue certificates that millions rely on. Several early CA applications were rejected due to inadequate infrastructure. CCA licensing criteria have been progressively tightened in line with CA/Browser Forum baseline requirements and after global incidents involving compromised CA infrastructure.
Key Amendments
2008 Amendment changed 'Digital Signature Certificate' to 'Electronic Signature Certificate' — broadening the licensing regime to cover non-PKI certificate types.
Class 2 DSC category effectively merged into Class 3 by CCA notification in 2021 — raising the baseline verification standard.